Cisco Talos Intelligence Group has discovered a new Android Trojan, GPlayed, which has an extensive set of embedded malicious tools as well as the ability to compose new modules from the compromised device's C&C server.
Furthermore, GPlayed's toolkit can be extended by its developers without the need to release a newer version. It can simply add new features either through a built-in system plugin or by upgrading the Trojan on the infected device.
GPlayed is designed to adapt according to the hacker's commands and be able to assume multiple roles, from a spying Trojan to a data-stealing Trojan, allowing the hacker to use it for many purposes, from tracking the victim's location to stealing banking credentials.
What is most worrying about GPlayed is the fact that its feature set can be easily customized after the Trojan has been deployed on the compromised machine with the help of the plug-in system and code editing capabilities mentioned above.
GPlayed has caused quite a stir as it is able to extract geolocation information, text messages, contacts and a complete list of all installed applications, while its self-managed modules allow it to load, compile and execute new modules from source code, change the C&C server as well as send or load new plugins.
Additionally, GPlayed allows hackers to lock or wipe the device, send SMS messages, add/remove web injects, display notifications, open the browser, and collect credit card information.
